Global – October 27, 2026 -- Three critical vulnerabilities rated CVSS 9.2 in Pillow, the Python imaging library with an estimated 436 million monthly downloads, let a single crafted EPS, TIFF or JPEG file trigger command execution or heap corruption in any Python service that processes user-supplied images. Disclosed on 2026-10-19, all three flaws are fixed in Pillow 13.0.0.

Pillow is a maintained fork of the original Python Imaging Library. Web frameworks such as Django and Flask, thumbnail and avatar pipelines, document and PDF tooling, and most Python machine-learning and computer-vision stacks pull it in directly or transitively. Because it routinely parses untrusted image bytes, the bugs are reachable through a plain file upload.

CVE-2026-112900 lets attackers inject Ghostscript options and run commands

Pillow renders EPS images by calling Ghostscript. The EPS plugin passes the input filename after the -f flag without converting it to an absolute path, so a filename beginning with - is parsed as an option. Combined with Ghostscript's @argfile syntax and control of that file, an attacker who controls the filename can run arbitrary commands, even under the default -dSAFER. The flaw is reachable only when the Ghostscript binary is present on the host.

CVE-2026-112393 overflows the heap when compressed TIFFs are saved to memory buffers

When a compressed TIFF is saved to a file-like object without an OS file descriptor, such as io.BytesIO, the buffer-grow loop sizes reallocation from the prior buffer size instead of the current write position. For output larger than 64 KiB, libtiff can seek past the buffer and write beyond the allocation. The bug also discloses stale heap bytes in unwritten alignment gaps. Saving to a real file path is not affected.

CVE-2026-112403 corrupts the heap through crafted lossless JPEGs

The JPEG decoder writes a full-width scanline into a buffer sized from tile or draft extents, not from the JPEG header. An attacker who feeds a crafted 8-bit lossless (SOF3) JPEG to an application calling draft() or thumbnail() makes libjpeg produce lines wider than the buffer. The result is a crash and potentially code execution. Newer libjpeg-turbo builds accept the malformed input that older libjpeg-turbo 2.x and IJG builds reject.

Upgrading to Pillow 13.0.0 is the only complete fix

Operators should run pip install -U "Pillow>=13.0.0" and rebuild any wheels, containers or base images that vendor the library. Beyond patching, teams should accept only the image formats they need, never pass an attacker-controlled filename to Image.open() for EPS, and keep the Ghostscript binary off hosts that process untrusted uploads. draft() and thumbnail() on untrusted JPEGs, and TIFF saves to in-memory buffers, are the sensitive code paths.